Skip to main content

Changelog

Version history and release notes for iNetPanel, sourced from GitHub releases.

Release History

v1.23.2 Latest March 26, 2026

Hotfix

  • Installer fails to download panel sourceinstall_LAMP.sh was pointing at inetpanel.tuxxin.com/inetpanel-latest.zip (404). The zip is a GitHub release asset, not hosted on the website. Fixed URL to github.com/tuxxin/iNetPanel/releases/latest/download/inetpanel-latest.zip.

Install / Update

bash <(curl -s https://inetpanel.tuxxin.com/latest)
v1.23.1 March 26, 2026

Hotfix

  • Multi-PHP install fails silently on fresh installs — The /var/www/inetpanel/storage/ directory wasn't created during deployment, causing status files and logs to never be written. The API now creates the directory if missing and returns a clear error if it can't.

Install / Update

bash <(curl -s https://inetpanel.tuxxin.com/latest)
Existing installs: run inetp panel_update from the admin panel or CLI.
v1.23 March 26, 2026

New: Release Channels (Stable vs Beta)

  • Installer now uses release tarballs instead of git clone — the repo (main branch) is now beta code, while GitHub Releases are stable.
  • - inetpanel.tuxxin.com/latest — stable installer (downloads release zip) - inetpanel.tuxxin.com/latest-beta — beta installer (clones main branch)
  • Settings → Updates → Release Channel — toggle between stable and beta without reinstalling. Stable pulls from tagged releases, beta pulls the latest commit from main.
  • Fixes

  • Multi-PHP install broken on all environmentssystemd-run --scope fails silently in LXC/Proxmox containers with no fallback, leaving the status file stuck at "running" forever. Added direct background execution fallback when systemd-run fails. Simplified the API exec() call and set a 3-minute timeout.

Install / Update

bash <(curl -s https://inetpanel.tuxxin.com/latest)
Existing installs: run inetp panel_update from the admin panel or CLI.
v1.22.3 March 26, 2026

Fixes

  • Dashboard disk stats inflateddisk_free_space() excludes ext4 reserved blocks (~5%), making "used" appear ~10 GB higher than reality. Now uses df output for accurate numbers matching what the OS reports.
  • PHP 5.6 install timeout — Polling timeout increased from 120s to 360s. Older PHP versions take longer to install via apt.
  • SSH port fix for LXC containers — Previous fix only checked is-active on ssh.socket, which misses cases where the socket is enabled but not yet active (common in LXC). Now checks list-unit-files and masks the socket unit to prevent reactivation.

Install / Update

curl -o latest https://inetpanel.tuxxin.com/latest && bash latest
Existing installs: run inetp panel_update from the admin panel or CLI.
v1.22.2 March 26, 2026

Fixes

  • SSH port ignored on Debian 12 — Installer now disables ssh.socket (systemd socket activation hardcodes port 22, overriding sshd_config Port 1022)
  • SSL cert reissue blocked after self-signed fallback — Cleans up non-LE certs from /etc/letsencrypt/live/ before certbot retry
  • CertBot DNS propagation timeout — Added --dns-cloudflare-propagation-seconds 30 (default 10s was too short)
  • Dashboard graph empty on fresh installinetpanel_stats was missing from manage_cron.sh allowed list, so the stats collector cron was never created
  • New

  • inetp optimize_server — Auto-tunes Apache2 mpm_event and MariaDB InnoDB/buffers based on detected RAM, CPU cores, disk type (SSD/HDD), and hosted domain count. Dry-run by default, --apply to write changes with automatic config backups.

Install / Update

curl -o latest https://inetpanel.tuxxin.com/latest && bash latest
Existing installs: run inetp panel_update from the admin panel or CLI.
v1.22.1 March 22, 2026

Logo rebrand & dark mode fixes (v1.22.1)

New branding

  • New logo — redesigned iNetPanel logo (PNG with transparency), replaces old .webp
  • Favicon — new Logo-Icon.webp favicon added to admin and account portals
  • Logo automatically inverts to white in dark mode via CSS filter
  • Account portal logo resized to 28px for cleaner navigation fit
  • Dark mode — root-level fix

    The core issue with dark mode was that Bootstrap 5.3 uses internal CSS variables (--bs-body-color, --bs-table-color, --bs-border-color, etc.) that our custom [data-theme="dark"] wasn't overriding. This caused all Bootstrap components to inherit dark text colors regardless of theme.

    Fix: Override all Bootstrap 5.3 internal CSS variables at the [data-theme="dark"] root level. This makes every Bootstrap component — tables, cards, headings, links, borders — automatically inherit correct dark mode colors without needing per-component overrides.

    Specific fixes

  • Table headers.table-light <thead> elements now display light text (previously black on dark background)
  • Nav tabs — dark mode styling for tabbed interfaces (multi-php, firewall pages)
  • Bootstrap 5.3 subtle utilitiesbg-success-subtle, bg-primary-subtle, bg-warning-subtle, bg-danger-subtle with proper dark variants
  • Close button — filter inversion for visibility on dark backgrounds
  • Warning badges — retain dark text for contrast on yellow background
  • Table borders — consistent border color in dark mode

Pages fixed

Accounts, DNS, Email, SSL, Firewall, Multi-PHP, Services, and all other pages that use Bootstrap tables, cards, or badges.

Closes #10

v1.22 March 22, 2026

Dark mode audit & fixes (v1.22)

Addresses #10 — dark mode inconsistencies and unreadable text.

CSS additions (58 new dark mode rules)

  • Badgesbg-light, text-dark, bg-secondary now theme-aware
  • Alerts — info, success, warning, danger with proper dark backgrounds and contrast
  • Pre/code blocks — proper dark background and text colors
  • Buttonsoutline-dark, outline-secondary, btn-light variants
  • Components — breadcrumbs, nav pills, pagination, input groups, progress bars, accordion, offcanvas, toast
  • Logo — brightness inversion filter for dark sidebar backgrounds
  • Hardcoded color fixes

  • Dashboard chart grid/tick colors now adapt to theme
  • QR code colors invert in dark mode (light modules on dark background)
  • Removed hardcoded #e8f4f8 alert background in settings
  • WireGuard code block uses theme-aware bg-light instead of bg-white
Closes #10
v1.21.9 March 22, 2026

Fix PHP package extension install/remove (v1.21.9)

Same root cause as v1.21.8dpkg triggers restart php-fpm during apt-get install/remove of individual extensions (e.g. php8.5-uploadprogress), killing the PHP worker mid-request.

Changes

  • Extension install/remove now runs inside systemd-run --scope to escape the FPM cgroup
  • Frontend uses async status polling with progress modal (matches multi-php pattern)
  • Modal only shown after API confirms operation started (prevents stuck modal on errors)
  • Added pkg_status API endpoint for polling extension install/remove progress
v1.21.8 March 22, 2026

Fix Multi-PHP install/remove (v1.21.8)

Root cause: dpkg triggers restart php-fpm during package install/remove, which kills all processes in the FPM cgroup — including the background apt script launched from PHP exec(). nohup/setsid don't help because systemd kills by cgroup, not process group.

Changes

  • Script re-launches itself via systemd-run --scope to escape the FPM cgroup before running apt
  • Fixed status file path mismatch between API and backend script
  • Fixed concurrent operation guard falling through to exec() instead of breaking the switch
  • Modal now only shown after API confirms success (prevents stuck modal on errors)
  • Status file removed immediately after verification, before slow post-cleanup steps
  • Moved apt logic from inline PHP to dedicated multiphp_manage.sh bash script
v1.21.7 March 22, 2026

v1.21.7 — Fix Multi-PHP: detached apt execution

Bug Fix

Multi-PHP install/remove silently fails

apt-get ran inside the PHP-FPM worker process. dpkg post-install hooks restart php-fpm, which kills the worker mid-execution — apt never completes, status file stuck at 'running', modal spins forever.

Fix: All apt operations now run in a detached bash script (sudo bash script.sh &) that survives FPM restarts. The script handles the full lifecycle: dpkg configure, apt install/purge, FPM enable/start, upload limits, module reinstall, and cleanup. Status tracking via temp file allows the polling UI to detect success (file removed) or failure (file contains 'error').

Files Changed

  • api/multiphp.php — Detached bash wrapper for apt operations
  • src/multiphp.php — Improved polling with seenRunning state tracking
  • TiCore/Version.php — Version bump
v1.21.6 March 22, 2026

v1.21.6 — Fix Multi-PHP status tracking

Bug Fix

Multi-PHP status file stuck at 'running'

The v1.21.5 status file mechanism never transitioned from 'running' to 'done' because dpkg post-install hooks triggered an FPM restart that killed the PHP worker before it could update the file. The polling modal would spin until timeout.

Fix: Status file is deleted immediately after apt succeeds, before any FPM operations. On apt failure, error is written and execution stops immediately.

Files Changed

  • api/multiphp.php — Reorder status file cleanup before FPM operations
  • TiCore/Version.php — Version bump
v1.21.5 March 22, 2026

v1.21.5 — Fix Multi-PHP background failure detection

Bug Fix

Multi-PHP install/remove modal spins forever on failure

When apt-get failed silently in the background (e.g. package not available, dpkg lock), the polling modal would spin indefinitely since the version state never changed.

Fix: Background apt operations now write status to a temp file. The polling list action reports this status, allowing the UI to detect errors and show them immediately instead of spinning for 3 minutes.

Files Changed

  • api/multiphp.php — Status file tracking for background apt operations
  • src/multiphp.php — Poll checks for background error status
  • TiCore/Version.php — Version bump
v1.21.4 March 22, 2026

v1.21.4 — Fix Multi-PHP removal & FPM pool cleanup

Bug Fixes

Multi-PHP removal causes 500 error

Removing a PHP version via the admin UI triggered an Internal Server Error because apt-get purge restarted the panel's own PHP-FPM process mid-request.

Fix: apt-get now runs after fastcgi_finish_request() so the browser receives a success response before the package removal begins. The UI polls until the version is fully removed before closing the progress modal.

Multi-PHP removal leaves packages behind

The purge command only removed specific packages (fpm, cli, common, etc.) but missed sub-packages like bz2, gd, intl — leaving the binary installed.

Fix: Uses wildcard php{ver}-* purge + apt-get autoremove to fully remove all packages for that version.

FPM pools not cleaned up on domain/account removal

Removing a domain or account from the admin UI deleted the pool config file but never reloaded PHP-FPM, leaving orphaned worker processes running.

Fix: Both the shell script and API now reload FPM after pool removal.

Database creation SQL syntax error

Creating a database from the client portal failed with "Unknown command" due to escaped backticks in the SQL statement.

New Features

inetp rebuild_pools

New CLI command to regenerate all missing PHP-FPM pool configs from the panel database. Useful for recovery after pool files are accidentally deleted.

Dashboard "Accounts & Domains"

The dashboard card now shows both account count and domain count (e.g. "3 / 5").

Files Changed (9 files)

TiCore/Version.php, api/account.php, api/accounts.php, api/multiphp.php, scripts/system/inetp, scripts/system/rebuild_pools.sh, scripts/system/remove_domain.sh, src/dashboard.php, src/multiphp.php
v1.21.3 March 19, 2026

v1.21.3 — Fix backup toggle and retention

Bug Fixes

Backup toggle not disabling backups

Toggling backups off in admin settings had no effect — the cron was always written with the backup command, and the script never checked the backup_enabled setting. Fresh installs saw system config backups appearing even with backups toggled off.

Fix:

  • api/settings.php: Checks backup_enabled before writing backup cron; writes a disabled comment when off

  • backup_accounts.sh: Exits early if backup_enabled = 0 (safety net); --single mode still works for domain removal
  • Backup retention not cleaning old files

    The retention cleanup never removed old backups because MTIME_DAYS was calculated inside the loop body but used in the find command's process substitution (which runs before the loop).

    Fix: Moved MTIME_DAYS calculation before the find command.

    Files Changed

  • api/settings.php — Backup toggle cron logic
  • scripts/system/backup_accounts.sh — Early exit guard + retention fix
  • TiCore/Version.php — Version bump
v1.21.2 March 19, 2026

v1.21.2 — Fix database creation, updated README

Bug Fix

Database creation from client portal

CREATE DATABASE used escapeshellarg() which wraps the name in single quotes — MySQL requires backticks for identifiers. All database creation attempts from /user/dashboard#database failed with ERROR 1064. Now uses backtick-wrapped identifiers with regex sanitization.

Updated

  • README rewritten — streamlined with home hosting focus, technical stack details, directory layout, and links to [inetpanel.tuxxin.com](https://inetpanel.tuxxin.com) for full documentation
  • Files Changed

  • api/account.php — Fix CREATE DATABASE SQL syntax
  • README.md — Rewrite
  • TiCore/Version.php — Version bump
v1.21.1 March 19, 2026

v1.21.1 — Fix: Missing cron jobs on fresh install

Bug Fix

Fresh installs missing stats collector and backup cron jobs

New installations were not setting up the stats_collector.sh cron (runs every minute) or the backup_accounts.sh cron (runs daily). These were only created by panel_update.php during subsequent updates, not during initial setup.

Symptoms: Dashboard graph shows no data, automated backups never run.

Fix: install.php now creates both cron jobs during initial setup:

  • /etc/cron.d/inetpanel_stats — stats collector every minute

  • /etc/cron.d/lamp_backup — daily backup at configured time
  • Note: Existing installations already have these crons (created by panel_update.php). This fix only affects new installations.

    Files Changed

  • public/install.php — Add stats and backup cron setup
  • TiCore/Version.php — Version bump to 1.21.1
v1.21 March 19, 2026

v1.21 — Public Release

Public Release

iNetPanel is now open source. This release removes all private repository requirements and prepares the codebase for public access.

Changes

Repository Access

  • Removed GitHub Personal Access Token (PAT) from admin settings, update system, and installer

  • install_LAMP.sh no longer prompts for authentication — clones directly from the public repo

  • Update system (panel_update.php) works without authentication tokens
  • Bug Fix: Private IP + Cloudflare DNS

  • Creating a server hostname DNS record with a private IP (192.168.x, 10.x, 172.16-31.x) now sets proxied: false — Cloudflare cannot proxy traffic to private addresses

  • Applies to both the installer (Step 5) and admin Settings > General
  • Upgrade Notes

  • Existing installations with a github_token setting: the token is harmlessly ignored and can be removed from the database
  • No breaking changes — all existing functionality works as before
  • Installation

    bash <(curl -s https://inetpanel.tuxxin.com/latest)
    

    Links

  • Documentation: https://inetpanel.tuxxin.com
  • Issues: https://github.com/tuxxin/iNetPanel/issues
  • TiCore Framework: https://ticore.tuxxin.com
v1.20.4 March 18, 2026

v1.20.4 — Critical: FPM Pool Recovery

Critical Fix

Auto-regenerate missing PHP-FPM pools on update

After an update, panel_update.php now checks all domains in the database and regenerates any missing FPM pool configs in /etc/php/{ver}/fpm/pool.d/. This prevents 503 Service Unavailable errors when PHP-FPM reloads and finds an empty pool directory.

If you're seeing 503 errors on all Apache-hosted sites, run the panel update from Settings > Updates — it will automatically detect and recreate missing pool configs, then reload FPM and Apache.

Firewall port range display

Fixed the firewall UI not showing port ranges like 40000-50000/tcp (used by FTP passive mode).

Files Changed

  • scripts/panel_update.php — FPM pool safety check + regeneration after every update
  • api/firewall.php — Port range regex fix
  • TiCore/Version.php — Version bump
v1.20.3 March 18, 2026

v1.20.3 — Hardened update script

Fix

  • Hardened rsync ownership handling — Added --chown=www-data:www-data directly to the rsync command so files are synced with correct ownership in a single operation. The post-rsync chown is kept as a safety net. This eliminates the 403 error that occurred in v1.20.1 where the executing (old) update script lacked the ownership fix.
No action needed if you're already running v1.20.2. Update normally from Settings > Updates.
v1.20.2 March 18, 2026

v1.20.2 — Critical: Fix 403 after update

Critical Fix

  • 403 Forbidden after panel update — The rsync in panel_update.php runs as root and overwrites file ownership to root:root. Lighttpd/PHP-FPM runs as www-data and cannot read the files, causing a 403 error on all pages. Fixed by restoring www-data:www-data ownership immediately after rsync.
If you are locked out after updating to v1.20.1, SSH into your server and run:
chown -R www-data:www-data /var/www/inetpanel/
Then update again from the admin panel to get this permanent fix.
v1.20.1 March 18, 2026

v1.20.1 — Patch: Migration Fix & Live Clock

Fixes

  • Database migrations not running on update — rsync excluded the entire db/ directory including db/migrations/. Now only excludes db/inetpanel.db, db/.installed, and db/.admin_pass. Users updating from v1.20 will now get the stats_history table created automatically, enabling the dashboard resource graph.
  • PMA config patching regex warnings — "Unknown modifier" and "Undefined variable $i" warnings during panel update. Switched regex delimiter from / to #.
  • Admin header live clock — Clock now ticks live every second, matching the client portal.
If you updated to v1.20 and your dashboard graph shows no data, update again from Settings > Updates to apply this fix.
v1.20 March 18, 2026

v1.20 — CLI Tools, Portal Redesign & Installer Hardening

New Features

11 New CLI Commands

  • inetp status — Server health summary (uptime, load, disk, RAM, services, SSL, backups)
  • inetp benchmark — Quick disk I/O, network speed, PHP opcache, MySQL query benchmarks
  • inetp reset_password --username USER — Reset FTP/SSH/MySQL password
  • inetp disk_report — Disk usage breakdown per user with top files/directories
  • inetp audit — Security audit (permissions, PHP versions, open ports, weak passwords, fail2ban)
  • inetp malware_scan --username USER — Scan for PHP backdoors/webshells
  • inetp cleanup — Clear temp files, old logs, orphaned FPM pools, stale sessions
  • inetp rotate_logs — Force logrotate on all user/system logs
  • inetp db_repair — Check and repair all MariaDB tables
  • inetp dns_check --domain DOMAIN — DNS propagation, SSL chain, HTTP response, CF tunnel check
  • inetp speedtest — Server bandwidth test (curl-based, no dependencies)
  • Dashboard Resource Graph

  • Historical CPU, memory, and network usage with 1h/24h/7d views
  • Background stats collector cron (every minute) populates stats_history table
  • Smooth Chart.js graphs with time-based x-axis labels
  • Client Portal Redesign

  • Overview: All domains listed in compact table with PHP version, web root, port, disk, status
  • Database: List existing databases, create new with username_ prefix, delete modal with PMA link
  • Multi-PHP: Change PHP version per domain with dropdown
  • Optimize: Image optimization with directory selection and dry-run preview
  • Backups: View and download account backups
  • File Manager: .htaccess editor with directory tree + password protection
  • FTP/SSH and SSH Keys moved to bottom of Overview tab
  • Domain dropdown only in File Manager and Optimize tabs
  • Live clock in header, user icon
  • Settings Hostname Verification

  • Verify button checks Cloudflare DNS for hostname existence
  • Auto-create A record if hostname is available
  • Server IP detection with private/public IP notice
  • VSFTPD Passive Mode Fix

  • Configured passive port range (40000–50000) in vsftpd.conf
  • Opened passive ports in firewalld
  • Fixes FTP upload failures on large batch transfers (GitHub issue #8)
  • Installer Distribution

  • latest file included in repo for web hosting at inetpanel.tuxxin.com/latest
  • Buy Me a Coffee

  • Support widget in sidebar footer (admin) and portal footer
  • Bug Fixes

    WireGuard

  • Firewall rule ordering — WG rules now added before restrictive DROP rules
  • Peer IP allocation — sequential /32 addresses from WG subnet
  • Config validation — prevents duplicate peers and invalid IPs
  • Peer cleanup on user deletion
  • Uninstall script fixes ListenAddress and port fallback
  • Installer Hardening

  • Lock file now blocks ALL requests (GET and POST) after installation
  • stats_history table added to install schema (schema_version bumped to 2)
  • MariaDB timezone tables loaded (mysql_tzinfo_to_sql) before setting timezone
  • Timezone config only persisted if runtime SET succeeds
  • event.target → button parameter fix for Cloudflare test button
  • Server IP fallback for DNS record creation
  • Null coalescing for POST values
  • Other Fixes

  • Settings hostname verify uses public CloudflareAPI methods (was calling private request())
  • Multi-PHP version change uses fastcgi_finish_request() before FPM reload (prevents 500 error)
  • Database listing uses sudo /bin/cat for MySQL root password (www-data can't read directly)
  • Admin PMA sidebar link routes through auto-login

Files Changed (37 files, +4334 / −290)

v1.19 March 18, 2026

v1.19 — Client Portal Overhaul & phpMyAdmin Auto-Login

New Features

Client Portal Overhaul

  • Complete redesign with tabbed dashboard: Overview, Database, FTP / SSH, File Manager, Backups, DNS, and Email
  • SSH Key Management — generate, import, and delete SSH keys directly from the portal
  • .htaccess File Manager — browse directories, edit .htaccess files, and password-protect directories with .htpasswd (supports multiple users)
  • Backups tab — view and download your account backups
  • Database info — explains username_* prefix convention for creating additional databases
  • phpMyAdmin Auto-Login

  • Token-based signon authentication — one-click login from both admin panel (as root) and client portal (as hosting user)
  • Deploys signon.php and patches PMA config automatically on panel update
  • Fallback login form prevents redirect loops when accessing PMA directly
  • Cloudflare DDoS & Development Mode

  • Toggle Under Attack Mode and Development Mode per zone from admin DNS page and client portal DNS tab
  • Immediate Cloudflare API calls with status feedback
  • System Config Backups

  • Automated backups now include system configuration files: Apache, PHP, MariaDB, lighttpd, fail2ban, WireGuard, SSH, cron, vsftpd, and the panel SQLite database
  • Same retention policy as user backups
  • MySQL Timezone Sync

  • Changing timezone in Settings or during installation now updates MariaDB global timezone and persists to /etc/mysql/mariadb.conf.d/99-timezone.cnf
  • Settings Deep Links

  • URL hash navigation: /admin/settings#general, #cloudflare, #updates, etc.
  • Hash updates in address bar on tab switch for bookmarking/sharing
  • Reserved Usernames

  • Banned username list (50+ system names) prevents creating hosting accounts with names like root, admin, www-data, mysql, etc.
  • Auto-generated usernames from domains are prefixed if they collide with reserved names
  • Bug Fixes

  • Admin PMA sidebar link now routes through /admin/phpmyadmin for auto-login instead of linking directly to port 8443
  • Portal PMA no longer falls back to root for regular user sessions
  • conf.d/pma_secure.php override patched during panel update

Files Changed (16 files, +1520 / -293)

README.md, TiCore/AccountAuth.php, TiCore/CloudflareAPI.php, TiCore/Version.php, api/account.php, api/accounts.php, api/dns.php, api/settings.php, public/index.php, public/install.php, scripts/panel_update.php, scripts/system/backup_accounts.sh, src/account/portal.php, src/dns.php, src/settings.php, themes/default/sidebar.php
v1.18 March 17, 2026

v1.18 — SSH Key Fix, UI Improvements

Bug Fixes

SSH Keys — chown invalid group (Fixes #3)

Hosting users are created with www-data as their primary group, but manage_ssh_keys.sh and fix_permissions.sh used chown user:user which fails because no personal group exists. Changed to chown user:www-data.

SSH Key Delete Button

The delete button in the SSH Keys modal did nothing when clicked. The onclick attribute used double quotes inside a double-quoted HTML attribute, silently breaking the click handler.

Form Autofill on Add Account

Chrome aggressively autofilled the username, domain, and password fields on /admin/add-account with saved login credentials. Fixed with readonly-on-focus trick for text fields and autocomplete="new-password" for password fields.

Files Changed

  • scripts/system/manage_ssh_keys.sh — chown fix
  • scripts/system/fix_permissions.sh — chown fix + corrected comment
  • src/accounts.php — SSH key delete button quote fix
  • src/add_account.php — anti-autofill attributes
  • TiCore/Version.php — version bump to 1.18
v1.17 March 14, 2026

v1.17 — Hook Scripts Fixes

Bug Fixes

Hook Scripts — 3 bugs fixed

1. PHP comment broke entire page JS — A // comment containing ?> prematurely closed the PHP block (a known PHP gotcha where ?> exits PHP mode even inside single-line comments). The nowdoc template assignment never executed, causing a fatal Undefined constant "SITE_TITLE" error that silently killed the <script> block. No buttons, toggles, or API calls worked.

2. Windows CRLF line endings broke bash validation — Windows browsers send \r\n in form data. Bash heredoc closing markers like HOMEEOF\r weren't recognized, causing "unexpected end of file" errors on Save/Validate. Fixed by stripping \r in the save, validate, and hook execution paths.

3. Hook scripts failed silently due to sudo permissionwww-data didn't have passwordless sudo for /bin/bash, so hooks logged "a terminal is required to read the password" and failed without any user-visible error. Added a scoped sudoers rule restricted to /bin/bash /tmp/inetp_hook_*.

Files Changed

  • src/hook_scripts.php — Fixed PHP comment
  • api/hook_scripts.php — Strip \r in save and validate actions
  • api/accounts.php — Strip \r in executeHook()
  • scripts/panel_update.php — Added sudoers rule for hook execution
  • TiCore/Version.php — Version bump to 1.17
v1.16 March 14, 2026

v1.16 — Update Notifications & Hook Scripts Fix

Changes

Update Notification Improvements

  • Removed duplicate "Update available" banner from sidebar footer — notification now only shows in the header bar
  • Added automatic version check on login so the header notification is immediately current
  • Header notification auto-clears after a manual panel update (no stale cache)
  • Bug Fix

  • Fixed Hook Scripts page: All buttons (Save, Validate, TiCore Template) and toggle switches were non-functional. The TiCore template contained <?= ?> PHP tags inside a JavaScript template literal — PHP processed them as code, causing a fatal error that silently broke the entire <script> block. Fixed by using a PHP nowdoc + json_encode to safely embed the template.
v1.15 March 14, 2026

v1.15 — Hook Scripts

Hook Scripts

New admin page for running custom bash code automatically after domain creation or deletion.

Features

  • Post Add Domain and Post Delete Domain hook editors with syntax highlighting
  • Toggle on/off per hook — saves immediately via AJAX without losing code
  • Bash syntax validation (bash -n) before saving — prevents broken scripts
  • Available Variables reference tables for each hook type (DOMAIN, USERNAME, PORT, DOC_ROOT, etc.)
  • TiCore Template — one-click auto-populate with a full TiCore PHP Framework deployment script
  • Hook execution runs after fastcgi_finish_request() — never blocks the API response
  • Hook failures are logged but never break domain operations
  • Hook Variables

    Add Domain: DOMAIN, USERNAME, PORT, DOC_ROOT, WEB_ROOT, LOG_DIR, SERVER_IP, PHP_VER, DB_NAME, DB_USER, DB_PASS Delete Domain: DOMAIN, USERNAME, PORT, DOC_ROOT, SERVER_IP

    Files Changed

  • api/hook_scripts.php — New API endpoint (get/save/toggle/validate)
  • src/hook_scripts.php — New admin UI page
  • api/accounts.phpexecuteHook() function + 4 hook call points
  • public/index.php — Page route + API route
  • themes/default/sidebar.php — Nav link under System section
  • TiCore/Version.php — Version bump to 1.15
v1.14 March 14, 2026

v1.14 — Beta Bug Fixes

What's New

  • Accounts filter: Fixed browser autocomplete filling the filter input with saved login credentials
  • Services & SSL refresh buttons: Fixed Refresh button not responding to clicks
  • Service monitor toggle: Now surfaces errors if the cron job fails to install/remove
  • Accounts disk size: Total now includes MariaDB database sizes (not just /home filesystem usage)
  • Settings > Updates: "Check Now" dynamically shows/hides the Update button without a page reload; page reloads automatically after an update completes
v1.13 March 14, 2026

v1.13 — Installer Fix, PHP API Hardening & Bug Fixes

What's New in v1.13

Critical Installer Fix

  • Fixed installer crash on minimal Debian 12: Added \sudo\ to base dependencies and \mkdir -p /etc/sudoers.d\ before writing the sudoers file — the installer was failing at the sudo rules step on fresh minimal installs, skipping panel deploy, crons, and firewall setup
  • Bug Fixes

  • Fixed 404 on sidebar restart button: "Yes, Restart Now" in the sidebar modal was linking to \/dashboard/restart\ (no route) — now correctly POSTs to the API
  • Fixed firewall page crash (PHP 8.x TypeError): \Shell::exec()\ returns an array; all callers in \api/firewall.php\ were passing it to \trim()\ as a string, crashing the entire firewall status page on PHP 8.x
  • Security Hardening

  • install.php POST bypass fixed: POST to \action=install\ was not blocked by the lock file check — re-installation was possible after setup
  • Server-side input validation added to installer: Username and password were only validated in the browser; backend now enforces format and minimum length
  • Backup path traversal protection: \backup_destination\ setting now validated before save (must be absolute path, no \..)\
  • DNS/Email read actions restricted to admin: \zones\, \list\, \list_rules\, \list_addresses\ were accessible to sub-admins who could see all Cloudflare zones/records
  • Backup list/settings now require admin role: Sub-admins could previously enumerate all backup files
  • Resilience

  • Installer DB transaction: All schema creation and settings inserts are now wrapped in a transaction — partial DB state is rolled back and cleaned up on failure so the install can be retried
  • Lock file written after commit: Previously written before system config steps; now written only after the DB is fully committed
  • Exec error logging: \timedatectl\, \hostnamectl\, \cloudflared_setup\, and \panel_ssl\ exit codes are now captured and logged
  • Cron write error checking: \popen()\/\pclose()\ calls for cron management now check return values and log failures
  • phpBin sanitized in settings API: \ddns_test\ action now uses \escapeshellarg()\ and validates the PHP version string before executing
  • Dynamic PHP version detection: Replaced hardcoded version arrays with \glob('/usr/sbin/php-fpm*')\ detection in both the installer and panel bootstrap
  • UX

  • Confirm password field added to installer: Previously a single password field with no confirmation
  • Simplified installer progress display: Replaced fake staged progress bar (with hardcoded delays) with a simple spinner that shows the real result immediately
v1.12 March 13, 2026

v1.12 — Debian 12 Resilience Hardening

Debian 12 Resilience Hardening

Hardens all 15 system scripts for reliable operation across diverse Debian 12 server configurations.

MySQL / MariaDB

  • Socket auth fallback — all 6 database scripts now work with both password-file and socket authentication (create_user, add_domain, delete_user, remove_domain, change_password, backup_accounts)
  • Password escapingchange_password.sh now properly escapes single quotes and backslashes in SQL
  • Portability Fixes

  • Removed grep -P (Perl regex) — replaced with portable grep -oE and bash [[ =~ ]] across create_user, remove_domain, and suspend_account
  • Auto-detect PHP-FPM versionpanel_ssl.sh no longer hardcodes PHP 8.5; detects installed version at runtime
  • Dynamic network interface detectionwireguard_setup.sh finds first non-loopback interface instead of assuming eth0
  • Safety & Error Handling

  • SSH lockout preventionupdate_ssh_port.sh validates sshd config (sshd -t) before restart; reverts on failure
  • certbot/openssl checksssl_manage.sh verifies tools exist before attempting certificate operations
  • mysqldump failure detectionbackup_accounts.sh now reports and removes empty SQL dumps instead of archiving them silently
  • cloudflared validationcloudflared_setup.sh validates binary path before writing systemd service file
  • WireGuard install verificationwireguard_setup.sh confirms wg command exists after apt-get install
  • Graceful process terminationdelete_user.sh sends SIGTERM, waits, then SIGKILL (was immediate SIGKILL)
  • Bug Fixes

  • service_monitor.sh — fixed false positives where non-existent services were never skipped (systemctl always returns 0)
  • panel_ssl.sh — prevent duplicate mod_openssl/mod_redirect insertion on re-run
  • wireguard_setup.sh — prevent duplicate net.ipv4.ip_forward entries in sysctl.conf
  • wireguard_uninstall.sh — reads WireGuard port from config before cleanup (was undefined)
  • wg_peer.sh — removed local keyword used outside functions (undefined behavior)
  • suspend_account.sh — removed dead PHP_VER="8.4" variable

Files Changed

16 files, 123 insertions, 40 deletions

Release notes are fetched from github.com/tuxxin/iNetPanel/releases and cached for 6 hours.